Enterprise identity infrastructure
Sign-in your users never think about
AuthCrest brokers Google sign-in, accounts and transactional messaging for portfolios of consumer web properties. One hardened layer, deployed per brand. Invisible when it works.
# one sign-in, brokered end to end GET brand.com/auth/login 302 auth.authcrest.com/start # signed request · 90s TTL 302 accounts.google.com/o/oauth2 # PKCE S256 · Google holds the password 302 auth.authcrest.com/callback # state verified 302 brand.com/auth/callback # sealed handoff · single use ✓ signed in — nothing retained on AuthCrest
Platform
One identity layer, deployed per brand
Every deployment gets the full stack: brokered sign-in, account surfaces and service messaging, isolated from every other brand on the platform.
Managed Google sign-in
OAuth 2.0 with PKCE S256, brokered per brand. No password is ever created, stored or seen: Google performs the sign-in, AuthCrest completes the handshake.
Stateless by design
The handshake rides an encrypted, short-lived cookie. There is no user database to breach, sell or subpoena: the broker holds nothing when the redirect completes.
Per-brand isolation
Handoffs are sealed with AES-GCM and bound to the requesting host; sessions are minted per brand and never shared. One property can never read another's users.
Transactional messaging
Service email delivered from each brand’s own domain, suppression-first, with consent evidence recorded before anything sends.
Data rights built in
Self-serve export and type-to-confirm deletion ship in every account surface, with suppression honoured permanently after erasure.
EU data residency
Brand account data lives on Cloudflare infrastructure with EU jurisdiction, retained on a published schedule, deleted on time.
Security
Small surface, sealed edges
The broker’s security model is subtraction: no credentials, no database, no long-lived tokens. What remains is signed, sealed and expiring.
aud-bound handoffs
Every handoff names the exact host it may land on and echoes the state that started it. Replaying it anywhere else is refused.
90-second, single-use tokens
A handoff dies at first use or 90 seconds, whichever comes first. There is nothing durable to steal in transit.
Signed start requests
Brands authenticate to the broker with a shared-key signature before a flow even begins; unsigned starts are refused outright.
Data & privacy
Signed in on a partner site? Here is exactly where your data lives
- What AuthCrest sees
- Your Google account name and email address, passed once to the site you chose to sign in to. The handshake itself is stateless and expires in seconds; AuthCrest keeps no database of users at all.
- Your password
- Stays with Google. AuthCrest never sees or stores it and cannot access your Google account.
- Your account data
- Saved items and preferences are held by the site you use, on Cloudflare infrastructure in the European Union, and are yours to export or delete at any time from that site’s account page.
- Questions or requests
- Use the account page of the site you signed in to, or write to privacy@authcrest.com.
Enterprise deployments only
AuthCrest is integrated per brand under enterprise agreements. No self-serve signup, no public pricing. If you operate consumer properties and want managed identity, talk to us.
partnerships@authcrest.com